CVE-2026-2236CWE-89

HGiga|C&Cm@il - SQL Injection

High · published February 9, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

⚡ An unauthenticated SQL injection vulnerability in C&Cm@il could let attackers access your database with just a sneaky command! 🔥 Think of this like a restaurant where anyone can stroll into the kitchen without a reservation and read the entire recipe book. If they know how to ask, they can just whip up whatever dish they want, even if they shouldn’t be in there at all! This could mean unauthorized users accessing sensitive information, stealing data, or even manipulating contents of your database. The consequences could be absolutely devastating, leading to data breaches that harm not just your organization but also your users' trust.

Put simply

Think of this like a restaurant where anyone can stroll into the kitchen without a reservation and read the entire recipe book. If they know how to ask, they can just whip up whatever dish they want, even if they shouldn’t be in there at all! The vulnerability allows attackers to inject arbitrary SQL commands into the database due to insufficient input validation, enabling them to read or manipulate database contents without needing authentication.

What to do

This could mean unauthorized users accessing sensitive information, stealing data, or even manipulating contents of your database. The consequences could be absolutely devastating, leading to data breaches that harm not just your organization but also your users' trust. To remediate this, immediately patch C&Cm@il to the latest version, ensure input validation mechanisms are in place, and conduct a security audit of your database queries. Don’t let those kitchen doors be wide open! You've got this! Follow these steps and you'll be well on your way to securing your application! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00476 · 40.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-09T07:20Z
EPSS history
Timeline
  • 09 FEB 07:20Z
    HGiga|C&Cm@il - SQL Injection
    cvelistv5